ci: cut Actions burn — scope push triggers + concurrency-cancel (#42)

Workflows fired on bare `[push, pull_request]`, running twice per PR commit
(branch push + PR synchronize). Scope push to [main, master] so PRs fire once;
add concurrency cancel-in-progress (read-only PR checks). Reduces the Actions
minute burn behind the estate spending-limit wall. No SPDX/logic changes.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath